hunting-for-ntlm-relay-attacks

【效率与协作】Detect NTLM relay attacks by analyzing Windows Event 4624 logon type 3 with NTLMSSP authentication, identifying IP-to-hostname mismatches, Responder traffic signatures, SMB signing status, and suspicious authentication patterns across the domain.

独立 GitHub 快照 · 自动分类 · 以原作者文档为准